What's happening
This bill requires businesses to destroy or encrypt personal information stored on copiers, fax machines, or multifunction devices before disposal or transfer.
Why it matters
Reduces risk of data breaches from disposed office equipment. Many modern copiers and multifunction devices store copies of scanned or printed documents, which can include sensitive personal information. The bill ensures this data is not accessible when the device changes hands, directly addressing a common source of accidental data leaks.
Sets clear technical standards for data protection. By requiring encryption or destruction methods that comply with recognized standards (such as those from NIST), the bill provides concrete guidance for businesses, reducing ambiguity and promoting best practices in data security.
Clarifies responsibilities for owners, lessees, and lessors. The law makes it clear that both the business using the device and, in lease situations, the device owner/lessor are responsible for ensuring data is destroyed or encrypted, helping prevent accountability gaps when equipment is returned or resold.
Exempts devices with no data storage risk. The bill does not apply to machines that are configured to prevent storing data or images, ensuring that requirements are targeted only at equipment that actually poses a privacy risk.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Erase Copier Data Safely
Plain English, a few words. Used as the page title.
Sponsors
1 Co-sponsor
History
- Ordered to third reading cal.231
- Returned to assembly
- Died in senate
- Referred to codes
- Delivered to senate
- Passed assembly
- Advanced to third reading cal.103
- Reported
- Reported referred to codes
- Referred to consumer affairs and protection
Full text
2 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
2856
2017-2018 Regular Sessions
IN ASSEMBLY
January 23, 2017
Introduced by M. of A. PEOPLES-STOKES -- read once and referred to the Committee on Consumer Affairs and Protection
AN ACT to amend the general business law, in relation to destruction of personal information stored on copiers, facsimile machines or multifunction devices
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. The general business law is amended by adding a new section 349-f to read as follows:
§ 349-f. Destruction of personal information stored on copiers, facsimile machines or multifunction devices. 1. For the purposes of this section:
(a) "Data storage device" means any device that stores information or data from any electronic or optical medium, including, without limitation, a computer, cellular telephone, magnetic tape, electronic computer drive and optical computer drive, and the medium itself.
(b) "Encryption" means the protection of data in electronic or optical form, in storage or in transit, using: (i) an encryption technology which has been adopted by an established standards setting body, including, without limitation, the federal information processing standards issued by the national institute of standards and technology, or its successor organization, and which renders such data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of such data; and (ii) appropriate management and safeguards of cryptographic keys to protect the integrity of the encryption using guidelines promulgated by an established standards setting body, including, without limitation, the national institute of standards and technology or its successor organization.
(c) "Multifunction device" means a machine that incorporates the functionality of multiple devices, which may include a printer, copier,
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD03623-01-7
A. 2856 2
scanner, facsimile machine or electronic mail terminal, to provide for the centralized management, distribution or production of documents.
2. A business entity or data collector that owns or possesses a copier, facsimile machine or multifunction device which uses a data storage device to store, reproduce, transmit or receive data or images that may contain personal information shall, before the business entity or data collector relinquishes ownership, physical custody or control of the copier, facsimile machine or multifunction device to another person, ensure that any personal information which is stored on the data storage device of the copier, facsimile machine or multifunction device is:
(a) secured through the use of encryption; or
(b) destroyed through the use of a physical or technological method that has been adopted by an established standards setting body, including, without limitation, a method prescribed by the most recent version of the federal information processing standards issued by the national institute of standards and technology or its successor organization.
3. If a business entity or data collector uses or possesses a copier, facsimile machine or multifunction device which uses a data storage device to store, reproduce, transmit or receive data or images that may contain personal information pursuant to a lease agreement or rental contract, the owner or lessor of the copier, facsimile machine or multifunction device shall, as soon as practicable after the termination or cancellation of the lease agreement or rental contract, or upon assuming physical custody or control of the copier, facsimile machine or multifunction device, ensure that any personal information which is stored on the data storage device of the copier, facsimile machine or multifunction device is destroyed through the use of a physical or technological method that has been adopted by an established standards setting body, including, without limitation, a method prescribed by the most recent version of the federal information processing standards issued by the national institute of standards and technology or its successor organization.
4. The provisions of subdivisions two and three of this section do not apply to a copier, facsimile machine or multifunction device which is used or configured in such a way as to prevent the storage of data or images that may contain personal information.
§ 2. This act shall take effect on the ninetieth day after it shall have become a law.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.